In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
[
{
"product": "CloudForms",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "4.7 and 5"
}
]
}
]